sw360-20.0.0-beta

sw360-20.0.0-beta

This is a beta release for the next major version 20.0.0 of SW360. The release includes numerous features, corrections, and improvements over the previous release 19.2.0.

This release serves as a preview of the upcoming major version 20.0.0 for testing and should not be used in production environments.

Highlight of the changes includes:

• Various vulnerabilities and security fixes.
• More endpoints created for the support of new UI project.
• Improvements on KeyCloak sync and user management.

Credits

The following GitHub users have contributed to the source code since the last release (in alphabetical order):

> Achal Jhawar <[email protected]>
> bibhuti230185 <[email protected]>
> Bibhuti Bhusan Dash <[email protected]>
> deo002 <[email protected]>
> dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
> Farooq Fateh Aftab <[email protected]>
> Gaurav Mishra <[email protected]>
> harshitg927 <[email protected]>
> Himanshu A Garode <[email protected]>
> Kaushlendra Pratap <[email protected]>
> Keerthi B L <[email protected]>
> Mohamed Hanafy <[email protected]>
> Nikesh kumar <[email protected]>
> nikesh <[email protected]>
> pranayh24 <[email protected]>
> Rajnish Kumar <[email protected]>
> Rudra Chopra <[email protected]>
> Sameed Ahmad <[email protected]>
> sathwik-y <[email protected]>
> suvrat1629 <[email protected]>

Please note that also many other persons usually contribute to the project with
reviews, testing, documentations, conversations or presentations.

Features

• 080b277bb feat(importCDX): enhance importer VCS sanitization
• c87d2c6b2 feat(vuln): pagination on vulnerabilities endpoint
• d588c924d feat(project): use DB side pagination
• 46cc985bd feat(component): use DB side pagination
• 13a9c716a feat(datahandler): prepare for paginated queries
• 0ba6dd02e feat(docs): add other response types in docs
• e4103eb3e feat(keycloak): set externalId on sync
• 85986c781 feat(Keycloak): Enhance user synchronization with batch processing and retry logic
• e01a4e9f6 feat(core): introduce quick search functionality for vulnerabilities
• 59f5c49fd feat(config): add old UI configs
• 44e6f563f feat(config): move more configs to DB
• 64158b1bd feat(rest): new Security user role.
• 7be4e0675 feat(Release): Need createdBy field for list of releases under a component
• b25398586 feat(Release) : Automate_check_for_Source_Code_Download_URL_1650
• 178743477 feat(rest): endpoint to get fossology connection configuration data.
• 310434d5e feat(obligation): add field comparators
• a75e59bbb feat(rest) : QuickFilter for Obligation page
• bcf5141a7 feat(rest) : Completed code for advance-search for packages
• 3b929a059 feat(Rest): Advance search for packages
• 3ca1d5b6e feat(rest): add SBOM file validation for SPDX and CycloneDX formats
• bbb4c6c01 feat(rest): endpoint to get src file list for the licences.
• 24d9d7df8 feat(keycloak): allow thrift loc to be configured
• 1480c0c75 feat(rest): add additional fields to clearing request endpoint.
• c4b541310 feat(rest): getting license info from release attachment's content id.
• d1a51acfa feat(rest): download users endpoint in CSV format
• b9be6bace feat(test): add test for invalid /mergeComponent
• 93928eeab feat(component): validate merge selection
• 2086cf14d feat(Rest): adding filter search in license clearing get endpoint.
• d7a6e4d28 feat(ECC): Add field containsCryptography in Release ECC-Backend
• 35aa150eb feat(rest): fossology attachment configs to API
• 85e406126 feat(rest): added AttachmentCleanUpControllerTest
• eae223d9a feat(rest): added search API integration tests
• f5493594f feat(rest): added tests for ecc rest endpoints

Corrections

• d07f0d922 fix(rest): add documentation for license types usage in admin view.
• 37c9a5951 fix(resource): no config read at init
• 1e63f38dc fix(test): disable ssl health endpoint not used
• 999eccda1 fix(xss): test for null value for strip
• c75442858 fix(spring): upgrade to 3.5.3 from 3.3.3
• 82e16b696 fix(rest): add license type usage check and restructure delete API response
• 8fe11c797 fix(rest): add vendor existence validation in getReleases endpoint
• 18ac76e0c fix(rest): handle missing component ID with 404 response.
• 176a70f56 fix(release): throw appropriate exceptions
• de970cafd fix(rest): add endpoint to merge two releases.
• 34ff1494e fix(controller): fix access for SECURITY_USER
• 7722ae9b0 fix(component): skip should accept URLs
• 3831b8a06 fix(Rest): Only admin users can delete license types in the admin license tab.
• a6dec7574 fix(svm): SVMSyncHandler dont return loop
• 547611a75 fix(rest): fix permission check
• 48893d23a Fix(Rest): Add quick search for license type.
• f1ec624ad fix(bug): Fixed pagination at projects table (#3069)
• 6f6eb2021 Add proper self-link with project ID in licenseClearing endpoint (#3135)
• 7a2680b80 fix(rest) : Missing request param for downloadlicenseinfo report
• 5432c35cd fix(components): read id for ComponentDTO
• aa2ca47ef fix(component): ComponentDTO for /splitcomponent
• a249b7ef1 fix(component): read list of attachments for merge
• ab5c62292 fix(rest): improve error messages for invalid SBOM file imports
• 4e26b0553 fix(cloudant): upgrade to 0.10.3 to fix gson issue
• f55dd3b5f fix(components): allow field createdBy
• 43c5d1de9 fix(deps): add com.sun.mail:jakarta.mail:2.0.1
• 348337a8f fix(spdx): fix deps for spdx-library v2
• c8a756b10 fix(sw360UserGroup): add missing CLEARING_EXPERT
• cdc2b5dcd fix(Security) : KeyCloak integration #3087
• f0f6ac7d6 fix(backend): fix FossologyConfig
• 2bfa0ae41 fix(fossology): fetch download timeout from ConfigContainer repository
• 68236f17d fix(docs): update scripts/utilities/README.md Documentation (#3066)
• 586bdc3bb fix(project): return updated releases
• bdf7648f8 fix(docs): fix OpenAPI docs /fossology/saveConfig

Infrastructure

• cce5b2cf9 chore(release): 20.0.0 beta release
• 4461e9ee1 chore(deps): bump org.dom4j:dom4j from 2.1.4 to 2.2.0
• 0f9a61592 chore(deps): bump step-security/harden-runner from 2.12.1 to 2.12.2
• d52f78f2c chore(deps): bump github/codeql-action from 3.29.1 to 3.29.2
• 2f76f4fc9 chore(deps): bump org.apache.maven.plugins:maven-gpg-plugin
• 3ddcf3e74 chore(deps-dev): bump nl.jqno.equalsverifier:equalsverifier
• d1a9ce73a chore(deps): bump keycloak.version from 26.2.5 to 26.3.0
• 852f097f8 chore(deps): bump tomcat from d2f9bdc to 5ea8fbd
• 49d03be83 chore(deps): bump maven from d9f3089 to 615bd38
• 8bd566560 perf(vuln): use views instead of mango query
• 7ca79f030 chore(rest): paginate users endpoint on DB
• 4ee6294b9 docs(controller): responses for /licensetype/usage
• e72f8207a chore(deps): bump maven from 3a4ab32 to d9f3089
• 1724114c4 chore(deps): bump github/codeql-action from 3.29.0 to 3.29.1
• 94d5ee4fd chore(deps-dev): bump nl.jqno.equalsverifier:equalsverifier
• dd8fe8dec chore(deps): bump org.springframework.security:spring-security-oauth2-authorization-server
• b7fc0e8a5 chore(deps): bump log4j2.version from 2.24.3 to 2.25.0
• 3d4f3d68b chore(deps-dev): bump net.bytebuddy:byte-buddy from 1.17.5 to 1.17.6
• 384f0c4d7 chore(deps): bump spring-security.version from 6.5.0 to 6.5.1
• df8addc43 chore(deps): bump docker/setup-buildx-action from 3.10.0 to 3.11.1
• ea9e7ab95 chore(deps): bump tomcat from f55695f to d2f9bdc
• 64ef2aacf chore(deps): bump org.wiremock:wiremock from 3.13.0 to 3.13.1
• dccbe71fd chore(deps-dev): bump nl.jqno.equalsverifier:equalsverifier
• 930c7b33d chore(deps): bump springdoc-openapi-stater-common.version
• ee35897ba chore(deps): bump jackson.version from 2.19.0 to 2.19.1
• 76464f7ba chore(deps): bump github/codeql-action from 3.28.19 to 3.29.0
• 388c0b024 chore(deps): bump step-security/harden-runner from 2.12.0 to 2.12.1
• d4814d4dd chore(deps): bump org.springframework:spring-web from 6.2.7 to 6.2.8
• 72787f9c2 chore(deps): bump org.codehaus.mojo:build-helper-maven-plugin
• 849b1bbca chore(deps): bump com.ibm.cloud:cloudant from 0.10.3 to 0.10.4
• 0bd9c6bd3 chore(deps): bump github/codeql-action from 3.28.18 to 3.28.19
• 98be9010b chore(deps): bump maven from 933900d to 3a4ab32
• 5bb6a9c5c chore(deps): bump tomcat from 8058582 to f55695f
• 09ababc26 chore(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2
• d6f94b768 chore(deps): bump docker/build-push-action from 6.17.0 to 6.18.0
• 39d02c7ac chore(deps): bump keycloak.version from 26.2.4 to 26.2.5
• 2f537d19a chore(deps): bump io.github.git-commit-id:git-commit-id-maven-plugin
• 24f1e19f8 chore(deps): bump org.mockito:mockito-core from 5.17.0 to 5.18.0
• 6c06523db chore(deps): bump org.apache.httpcomponents.client5:httpclient5
• c2bfc63c2 chore(deps): bump spring-security.version from 6.4.5 to 6.5.0
• 9b3c09f76 chore(mail): update MR email to include docname
• 5dd802ff4 chore(mail): added more information to the mails
• 57f5de1a2 chore(deps): bump actions/dependency-review-action from 4.7.0 to 4.7.1
• cfcc346f6 chore(deps): bump docker/build-push-action from 6.16.0 to 6.17.0
• c7bc2e410 chore(deps): bump github/codeql-action from 3.28.17 to 3.28.18
• 4719c400a chore(deps): bump tomcat from 7edbb52 to 8058582
• e51667a87 chore(deps-dev): bump nl.jqno.equalsverifier:equalsverifier
• 61e34e9b6 chore(deps): bump org.json:json from 20250107 to 20250517
• 67e95b77a chore(deps): bump springframework.version from 6.2.6 to 6.2.7
• c9252e8b1 ...

sw360-19.2.0

sw360-19.2.0

This minor release includes numerous features, corrections, and improvements across the SW360 project since the 19.1.0 release.

Highlight of the changes includes:

• Various vulnerabilities and security fixes.
• Unified/simplified REST API error response with Exceptions.
• New endpoint to get and update SW360 config (also making it possible to update on fly).
• Multitude of REST API endpoint improvements and additions.
• linux/amd64 and linux/arm64 multi-arch docker image support.

Credits

The following GitHub users have contributed to the source code since the last release (in alphabetical order):

> Akshit Joshi <[email protected]>
> Bibhuti Bhusan dash bibhuti230185 <[email protected]>
> dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
> duonglq-tsdv <[email protected]>
> Farooq Fateh Aftab <[email protected]>
> Gaurav Mishra <[email protected]>
> Helio Chissini de Castro <[email protected]>
> hoangnt2 <[email protected]>
> Keerthi B L <[email protected]>
> mishraditi <[email protected]>
> Mohamed Hanafy <[email protected]>
> Nikesh kumar <[email protected]>
> Rudra Chopra <[email protected]>
> Sameed <[email protected]>
> Shi Qiu <[email protected]>
> Shushant <[email protected]>
> Smruti Prakash Sahoo <[email protected]>

Please note that also many other persons usually contribute to the project with reviews, testing, documentations, conversations or presentations.

Features

• 2d51a3097 feat(exception): replace deprecated exception
• f133b896d feat(Configurations): Add new endpoints that allow to GET/UPDATE SW360 configurations
• 5fa3afec1 feat(version): generate OpenAPI doc version on fly
• d8f6b01d8 feat(Department): Add new endpoints: - Get/Update department members - Get importing department's log file list and content
• edec79367 feat(addNewComponentType) : Added new component type COTS-Trusted Supplier
• e464254be feat(rest): Added tests for upload and download components
• d8393a319 feat(rest): Added endpoints to fetch schedule service status
• a1a01c89d feat(rest) : Endpoint for export SBOM at project detail page
• f15fd779a feat(script): read host, user and pass as args
• 8d5a77ee7 feat(rest): new rest endpoint for edit obligation
• 65db380b9 feat(project): add new values to project state field
• 8c17597a4 feat(exportCDX): update CycloneDX exporter dependency from v1.4 to v1.6
• a84a42b48 feat(rest): Count of attachments used in different projects.
• f40e72c3c feat(rest): create new endpoint for bulk delete function
• 927da5a54 feat(rest) : Search for vendors added.
• 45a53b4e2 feat: Add multiarch for docker image
• 6373bed28 feat(rest) : Comment added to reuse methods for Duplicateobligation functionality
• e764a5823 feat(rest): endpoint to merge vendor.
• 4bab8d07a feat(User): Add 2 new endpoints: - Allow Admin user to update user - List all existing department
• 2d0664f2f feat(rest) : Advanced Search for project page
• f15ccd798 feat(rest): standardize POST response to include created entity ID
• c273f1925 feat(rest): create new endpoint to delete ModerationRequests by id.
• be7606f32 feat(rest): create new enpoint to upload component csv file.
• 068385703 feat(api): complete advance search for components

Corrections

• 1b92b5135 fix(spdx): add null and empty field checks for SPDX documents
• 2d1ace631 fix(ci): set min version of CMake to 3.5
• 1cb9e8f4e fix(test): fix test cases for correct exceptions
• 4cba33716 fix(controller): fix further changes after rebase
• eb73f32c4 fix(Obligations): includes ObligationLevel in get all obligations responses
• b0d1be0d0 fix(security): remove WebSecurityCustomizer
• 991eb8f0a fix(xss): ignore essential headers from XSS filter
• 00d3cb129 fix(project): set fields getLicenseObligationData
• ef153bce9 fix(obligation): fix obligation patch
• 5f6796ee6 fix(rest) : Advancesearch(AdditionalData) for project page with value based search
• 9daf29b74 fix(Project): Resolve issue with embedded type in project release response when length is 0
• e415d05a4 fix: Set docker main and development image
• 9038d8dd2 fix: Adjust copyrights and licenses properly
• 72dbb8c72 fix(projectService): fix user role check
• 18193631b fix(rest): Add license information linking for project releases.
• 5336aea47 fix(script): fix addUnsafeDefaultClient.sh script
• 00b552d58 fix(SPDXDocument): Fix bug add SPDX document always return fail
• d4c0f913c fix(Token): Fix bug authentication by user token not working
• 5b3535a9b fix(project): add more null checks for attachments
• 0e9052f23 fix(project): null check at /summaryAdministration
• 840fa9740 fix: Adjust sw360 container build for external thrift
• e378da720 fix(Admin): fix OAuth Client deserialization and database operations
• cb52c1ad6 fix(Rest): Create new endpoint to activate the department manually.
• 4adc4a268 fix(rest) : Add licenseInfoHeaderText in summaryAdministration api response
• cadc213e9 fix(rest) : Moderation update overwrites previous fields
• d3aeefc6d fix(Attachment): Make get attachment endpoints of component/release/project consistent - Allow updating project/component/release with attachment data (in a consistent way)
• 48f9159bb fix(Rest): new endpoint will help to get the package details by projectId.
• fbea70a91 fix(rest): Added packageIds in project create and update APIs.
• 886ad473c fix(Rest): Updated the REST endpoint to schedule the upload of release component attachments.
• 975e30f49 fix(importCDX): Add logging for null metadata in sbom.
• 41ea54857 fix(licenseinfo): Corrected the Open Source title in TEXT format to match DOCX format
• 6ba3bf675 fix(rest): Prevent stored XSS
• 5365f10b8 fix(component): add null check for release merge
• b91d3ad10 fix(rest): Added code to get obligation releaseView data in project.
• bbd7a4361 fix(Rest): License overview is not updating in summary page.
• eeb3c86d4 fix(rest): fix doc for ModerationRequestController
• 663ac8377 fix(rest): Validate comment message while create a moderation request.
• 6dbec3601 fix(rest): adding additional fields to attachmentUsage endpoint.
• 325cf0ef5 fix(deps): Deprecate old commmons-lang library
• 75d3748cc fix(cloudant): fix structure of elemMatch query
• aadf18948 fix(report): refactor /reports endpoint
• 20d02c954 fix(doc): fix OpenAPI docs for report controller
• 73726c45e fix(moderation): fix moderation creation
• 1cd3739bd fix(rest) : modified attachment info in response to the moderation request rest api
• 1e1c5c1d0 fix(rest): Added code for for updating multiple project attachments.
• c8b27567f fix(rest) : Closed Project functionalities not uniform with respect to UI and REST

Infrastructure

• 57827d8ed chore(deps): bump org.jacoco:jacoco-maven-plugin from 0.8.12 to 0.8.13
• 9bfa90129 chore(deps): bump com.tngtech.jgiven:jgiven-maven-plugin
• 30d5f61ab chore(deps): bump org.apache.maven.plugins:maven-surefire-plugin
• 40a22ede4 chore(deps): bump poi.version from 5.4.0 to 5.4.1
• fad1b859a chore(deps): bump step-security/harden-runner from 2.11.0 to 2.11.1
• f73f40dc4 chore(deps): bump actions/dependency-review-action from 4.5.0 to 4.6.0
• 9f208baf0 chore(rest): rework exceptions
• b14bf4058 chore(deps): bump github/codeql-action from 3.28.12 to 3.28.13
• 5387e3fcd chore(deps): bump maven from 70591cb to f1e4a85
• 87806a5ae chore(deps-dev): bump nl.jqno.equalsverifier:equalsverifier
• 5a3acda61 chore(deps): bump springdoc-openapi-stater-common.version
• b15710833 chore(deps): bump org.apache.httpcomponents.client5:httpclient5
• 0cded8b31 chore(deps): bump org.ow2.asm.version from 9.7.1 to 9.8
• d2de95f47 chore(deps): bump httpcore5.version from 5.3.2 to 5.3.4
• b0e52e4f6 chore(deps): bump org.mockito:mockito-core from 5.15.2 to 5.16.1
• 2a1ea1952 chore(deps-dev): bump com.tngtech.jgiven:jgiven-junit
• 350a8db21 chore(deps): bump com.google.guava:failureaccess from 1.0.2 to 1.0.3
• b4b475444 chore(deps): bump org.apache.maven.plugins:maven-compiler-plugin
• 197ed98b4 chore(deps): bump springframework.version from 6.2.4 to 6.2.5
• 8c87ab4ed chore(deps): bump actions/cache from 4.2.2 to 4.2.3
• 403020e2b chore(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2
• 4809763e4 chore(deps): bump github/codeql-action from 3.28.11 to 3.28.12
• 3ac6ea7df chore(deps): bump org.springframework.security:spring-security-crypto
• 64a8742a7 doc(sbom): add allowable SBOM export types
• 40c061cdf chore(controller): fix typo in endpoint name
• dfe68e180 chore(deps): bump docker/login-action from 3.3.0 to 3.4.0
• 712d613ed chore(deps): bump org.springframework.security:spring-security-oauth2-authorization-server
• 1b05c7add chore(deps): bump com.ibm.cloud:cloudant from 0.10.0 to 0.10.2
• 1ac13a85a chore(deps): bump keycloak.version from 26.1.3 to 26.1.4
• dff3a99d9 chore(deps): bump springframework.version from 6.2.3 to 6.2.4
• fc4910ec0 chore(deps): bump org.cyclonedx:cyclonedx-core-java
• 38e0f199a chore: Add push docker tag capability
• 4e424695b refactor(rest): enhance logging and error handling in FossologyRestClient
• 79beaf846 chore(deps): bump docker/build-push-action from 6.13.0 to 6.15.0
• ac0cf9887 chore(deps): bump docker/metadata-action from 5.6.1 to 5.7.0
• 341fad29b chore(deps): bump docker/setup-buildx-action from 3.9.0 to 3.10.0
• c442800bd chore(deps): bump github/codeql-action from 3.28.10 to 3.28.11
• 1b2c6f8f8 chore(deps): bump tomcat from 0530899 to 1374a56
• 344b6995f chore(deps): bump slf4j.version from 2.0.16 t...

sw360-19.1.0

sw360-19.1.0

This minor release includes numerous features, corrections, and improvements across the SW360 project since the 19.0.0 release.

Highlight of the changes includes:

• Various vulnerabilities and security fixes.
• Multiple new REST API endpoints.
• Improvements on SBOM and CDX import.

Credits

The following GitHub users have contributed to the source code since the last release (in alphabetical order):

> Afsah Syeda <[email protected]>
> Akshit Joshi <[email protected]>
> Arun Azhakesan <[email protected]>
> dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
> duonglq-tsdv <[email protected]>
> Gaurav Mishra <[email protected]>
> Helio Chissini de Castro <[email protected]>
> hoangnt2 <[email protected]>
> Keerthi B L <[email protected]>
> nikesh kumar <[email protected]>
> Rudra Chopra <[email protected]>
> Sameed <[email protected]>
> Smruti Prakash Sahoo <[email protected]>
> StepSecurity Bot <[email protected]>
> tuannn2 <[email protected]>

Please note that also many other persons usually contribute to the project with reviews, testing, documentations, conversations or presentations.

Features

• 2133694fa feat(rest) : Export Project Create Clearing Request
• 36df4a611 feat(spdx): Add API for feature SPDX Document tab
• 719165516 feat(rest): endpoint to get license info header text.
• c64470ff8 feat(rest): Add documentation for new clearing size parameter.
• e02307383 feat(rest) : Rest end point for project ECC Export Spreadsheet
• 9cd8646c1 feat(Component): Add new endpoint that allows user to subscribe and unsubscribe to a component
• a3edc6cee feat(Release): Add new endpoint for release subscription
• 8d6315f31 feat(FossologyTrigger): stop repetitive entries of attachment.
• 3a48426c9 feat(ImportCDX):Handle redirection of VCS URLs in SBOM
• be8d94046 feat(rest): Create new api's in schedule tab.
• f41b8927d feat(importCDX): Add functionality to configure release creation when importing SBOM to an existing project
• ddec17e5d feat(rest): Add size parameter to clearing request.
• be032e39c feat(importCDX): enhance CDX importer to sanitize VCS URLs for non-GitHub domains
• 646c4e1bb feat(Project): Create new endpoint that allow to duplicate project with network
• 68c1fb737 feat(Release): Add new endpoint to check cyclic links between releases
• 9b32525a3 feat(Project): Add new endpoint that allow to compare project network with default network
• 108ba6700 feat(Project): Add new endpoint to fetch linked releases of linked projects
• 067f9135b feat(Release): Add new endpoint that allow to get linked releases of release
• 466a8c6d7 feat(Project): Create new endpoint that allow to get linked releases in dependency network of a project
• 75e3bc899 feat(rest): Add endpoint to handle updation of clearing requests.
• 7bcedef6a feat(rest): endpoint to remove orphaned obligations from project.
• fa17c2fed feat(rest): delete a vendor by id.
• 453eff793 feat: Add default user/pwd to couchdb connection
• e81031333 feat: Add default admin user if database is empty
• f98db4ff4 feat(rest): Add pagination to get clearing requests endpoint and fix 403 forbidden error
• 33012fdc2 feat(REST):fetch releases that are in NEW_CLEARING state and have a SRC/SRS attachment using parameter isNewClearingWithSourceAvailable
• 2621657cd feat: Add logging to identify releases with corrupted attachments during license generation
• 73d0576c7 feat(rest): endpoint to get list of obligations depending upon obligation level.
• 24b71c5e6 feat: Update README.md with openssf scorecard badge

Corrections

• 802013389 fix(openapi)!: add health endpoint to openapi
• b39c71b5b fix(Cloudant): Fix Cloudant document creation error by setting id and rev to null instead of empty string during Java object conversion
• da677a677 Revert "fix(importCDX): Resolved unnecessary update of component fields"
• 8f9859955 fix(docs): fix OpenAPI docs
• 8164a1f48 fix(rest): Fixed the reference to wrong db for oauthclients
• 4918ecd85 fix(test): Remove unused invalid entries
• 7c4b647e9 fix(test): Remove unused invalid entries
• ac410370c fix: Enable back client library
• c41cdedfc fix: Ignore SECURITY.md on license check
• ffd83c62f fix(Project): Add missing properties in network response
• 849284e3b fix(Project): Unset unnecessory data before store network into database
• 87bdf001e fix(test): enable unauthorized request test
• 519496118 fix(Project): Fix vulnerability: Information exposure through an error message
• 48eb7437e fix(User): Fix XSS vulnerability due to a user-provided value
• 89e67b7e9 fix(Rest): component attachment deletion while updating externalIds
• c35e05fbd fix: Create sw360oauthclients database
• 9cfb2c16d fix(rest): Enhance the acceptRequest method to see the proposed changes in project/component/release pages.
• 342145702 fix: Restore target for Dockerfile
• e18227af9 fix: Remove spotless dead code
• ec6d2bc18 fix: Adjust pinned dependencies on Dockerfile
• 73e682053 fix: Update POI code to modern version
• a2734ca50 fix(StepSecurity): Apply security best practices

Infrastructure

• 8a0793ed5 chore(deps): bump org.apache.maven.plugins:maven-gpg-plugin
• 06426f8bb chore(deps): bump keycloak.version from 26.0.6 to 26.0.7
• 385a8bc74 chore(deps): bump tomcat from 7ebc6c3 to 935ff51
• d24a5c32a chore(deps): bump github/codeql-action from 3.27.6 to 3.27.9
• e38177ad1 chore(deps-dev): bump com.tngtech.jgiven:jgiven-junit
• 7277d0815 chore(deps): bump org.apache.maven.plugins:maven-javadoc-plugin
• e424549f5 chore(deps): update wiremock to 3.10.0
• e35110da8 chore(deps): use updated wiremock
• c5cbf16f4 chore(deps): bump org.apache.httpcomponents.client5:httpclient5
• d59b81243 chore(deps): bump actions/cache from 4.1.2 to 4.2.0
• e15aa510c chore(deps): bump maven from 9ae8f00 to 85d505f
• 97c483c04 chore(deps): bump net.minidev:json-smart from 2.4.10 to 2.5.1
• 862a08e73 chore(deps): bump maven from f401172 to 9ae8f00
• e0bec4851 chore(deps): bump commons-io:commons-io from 2.17.0 to 2.18.0
• 668953ad0 chore(deps): bump org.mockito:mockito-core from 2.28.2 to 5.14.2
• 684e0703c chore(deps): bump maven from 5a44dff to f401172
• b80aaa302 chore(deps): bump tomcat from 2ade2b0 to 7ebc6c3
• 39bb1e985 chore(deps): bump ubuntu from 35b7fc7 to 80dd3c3
• f24cbc910 chore(deps): bump github/codeql-action from 3.27.5 to 3.27.6
• 0db57d021 chore(deps): bump ubuntu from 278628f to 35b7fc7
• db32f3bb8 chore: Remove cache from java-setup action
• 03dda4438 chore(deps): bump org.codehaus.mojo:versions-maven-plugin
• 2a4c3c3a6 chore(deps): bump org.apache.maven.plugins:maven-assembly-plugin
• 92f05513f chore(deps): bump org.apache.maven.plugins:maven-resources-plugin
• 1c3aefe32 chore(deps): bump jackson.version from 2.18.1 to 2.18.2
• 6d5b60f67 chore(deps): bump org.springframework.security:spring-security-oauth2-authorization-server
• 360f63268 chore(deps): bump docker/build-push-action from 6.9.0 to 6.10.0
• 75b9565a2 chore(deps): bump org.apache.maven.plugins:maven-dependency-plugin
• 8589b49b9 chore(deps-dev): bump com.github.tomakehurst:wiremock-jre8
• b4362b73d chore(deps): bump org.apache.commons:commons-lang3 from 3.12.0 to 3.17.0
• c0f95baab chore(deps): Fix Maven warning for deprecation values
• 067a3025e chore(deps): bump org.apache.commons:commons-csv from 1.10.0 to 1.12.0
• 41da93540 chore(deps): Move versions to supperpom
• 2dfa4afdb chore(deps): bump org.keycloak:keycloak-core from 26.0.5 to 26.0.6
• 90c1a4724 chore(deps): bump log4j2.version from 2.24.1 to 2.24.2
• a2beaa41e chore(deps-dev): bump net.bytebuddy:byte-buddy from 1.10.18 to 1.15.10
• cca5c12a9 chore(deps-dev): bump org.ow2.asm:asm-commons from 7.1 to 9.7.1
• ec4e041f6 chore(deps): bump springframework.version from 6.1.14 to 6.2.0
• bb9225664 chore(deps): bump org.apache.maven.plugins:maven-enforcer-plugin
• c4b75cf53 chore(deps): bump com.google.guava:guava from 32.0.0-jre to 33.3.1-jre
• c3c75c7df chore(deps): bump spring-security.version from 6.3.3 to 6.4.1
• bca5bc337 chore(deps): bump github/codeql-action from 3.27.4 to 3.27.5
• df9bf4801 chore(deps): bump actions/dependency-review-action from 4.4.0 to 4.5.0
• eaf13a8d6 chore(deps): bump docker/metadata-action from 5.5.1 to 5.6.1
• 9bf808d70 chore(deps): bump org.apache.maven.plugins:maven-failsafe-plugin
• a11f1830f chore(deps): Update apache.commons-compress
• 3658d3970 chore(deps): bump org.apache.commons:commons-text from 1.10.0 to 1.12.0
• 6cd1da38b chore(deps): bump com.tngtech.jgiven:jgiven-maven-plugin
• 36398cfbb Update security.md file
• ce6aa331c Create SECURITY.md
• a2a88dc79 chore(deps): bump step-security/harden-runner from 2.10.1 to 2.10.2
• 12bd1bf81 chore(deps): bump org.projectlombok:lombok from 1.18.34 to 1.18.36
• 4d336c6ad chore(deps): bump jackson.version from 2.17.1 to 2.18.1
• cce753580 chore(deps-dev): bump nl.jqno.equalsverifier:equalsverifier
• 6098b6723 chore(deps): bump com.github.package-url:packageurl-java
• 40ec24f69 chore(deps): bump tomcat from a09d4c1 to 2ade2b0
• 965ac8dc2 chore(deps): bump ubuntu from 99c3519 to 278628f
• 49c3e574f chore(deps): bump maven from 440a97a to 5a44dff
• a91c6249c chore(deps): bump httpcore5.version from 5.2.5 to 5.3.1
• f2b202b7a chore(docs): update the KeyCloak doc for 26.0.5
• 8f9492422 chore(deps): bump keycloak.version from 25.0.6 to 26.0.5
• 6239843ef chore(deps): Adjust Maven dependency declarations
• 9fa14d2e3 chore: Remove pre-commit checkstyl...

sw360-19.0.0

sw360-19.0.0

This tag covers many corrections, bug fixes and features after the 18.1 release. Version 19.0.0 is also the first release without the Front-end integrated, but as a separate sw360-frontend project.

Major changes in the release includes:

• Removal of Liferay and related libraries, OSGi framework
• Unification of various backend packages from src and svd
• Support for Java 21 and Apache Tomcat 11.0.0
• Replace couchdb-lucene with couchdb-nouveau

Credits

The following GitHub users have contributed to the source code since the last release (in alphabetical order):

> afsahsyeda <[email protected]>
> Akshit Joshi <[email protected]>
> Gaurav Mishra <[email protected]>
> Helio Chissini de Castro <[email protected]>
> hoangnt2 <[email protected]>
> Keerthi B L <[email protected]>
> Nikesh Kumar <[email protected]>
> Rudra Chopra <[email protected]>
> Sameed <[email protected]>
> Smruti Prakash Sahoo <[email protected]>
> tuannn2 <[email protected]>

Please note that also many other persons usually contribute to the project with reviews, testing, documentations, conversations or presentations.

Features

• c167bcca9 feat(rest): Endpoint to add comment on a clearing request
• cd97b6154 feat(rest): Create new endpoint for schedule CVE and schedule attachment deletion.
• 00d70bcc5 feat(rest): get releases used by vendor
• 31b720b9e feat(rest) : Rest end point for generate source code bundle
• 062a89290 feat(rest): saveUsages in project page
• 9751a2e1a feat(Project): Add new endpoint for project's license clearing tree view (New GUI)
• 546d35b73 feat(Project): Import SPDX as dependency network
• a18b053f5 feat(rest): Create new endpoint to download component template in csv format.
• 144ea5b81 feat(rest) : Move GenerateLicenseInfoFile rest end point to SW360reportcontroller
• 61ec9ac39 feat(REST): Exclude release version from license info
• 295f1cbff feat(rest): fetch group list in project add and edit page.
• e9ec8d8a7 feat: Make Java 21 default
• cb99fc678 feat(ImportSBOM):Change naming convention of imported components
• 441fa7d85 feat(Project): Create new endpoint to serve list view of dependency network (New GUI)
• 7b4c534e3 feat(cloudant): use IBM SDK
• 09586fad6 feat(ektorp): remove ektorp from search handlers
• af0262112 feat(lucene): nouveau integration
• a019b468b feat(keycloak-spis): Added the custom keycloak SPIs
• 3c453670d feat(couchdb): Enable use of latest CouchDB with nouveau
• 8fdd93c86 feat(rest): endpoint to update a vendor.
• bff430140 feat: Add CODEOWNERS to the repository
• 90ad3ea1c feat(rest): Add additional fields in get clearingrequest endpoints.
• 771b965b2 feat(ComponentPortletandImportCDX): Validate VCS URL and sanitize GitHub Repo URLs during CDX import
• 99d0c80ed feat(api): postpone moderation request action
• af15a09e3 feat(rest): includeAllAttachments parameter in licenseInfo endpoint
• 66cac90c6 feat(CycloneDX): Make methods compatible with cyclonedx upgrade and update jackson version
• 9a15832c0 feat(rest): Endpoint to get comments of a Clearing Request.
• ffbf1b183 feat(project): endpoint for vulnerabilitySummary page.
• 0d6908ab2 feat(project): Add necessary library dependencies required by rest code
• acb1e54ea feat(vscode): Add base Eclipse java formatter config file
• a29d5b0c2 feat: Generate provenance and SBOMs on Docker images
• 8b6aa42cf feat(docs): Remove old asciidocs support
• fd0546244 feat: Update to Ubuntu 24.04 (Noble)
• 8f971f765 feat(rest): new endpoint for releases of linked projects.
• 5bd4cae83 feat(obligation): rest endpoint to update license obligations of the project.
• 3c40f09f2 feat(License): Add API Listing LicenseType and Add pageble for licenses, obligations
• 204ce2f02 feat: Add scorecard

Corrections

• 9452b2b89 fix(cloudant): fix attachment creation
• 5bdef6d51 fix(pom): fixed the java version in kc module pom.xml
• 48e0f6c8c fix(ImportCDX): VCS sanitization failing on characters like colon
• dc18109b8 fix(Project): Fix project handler test with dependency network feature
• 5702dc595 fix(clearingState): making fossology report download configurable.
• 3f10b6856 fix(build): add the missing excludeReleaseVersion
• 69fcc6c9f fix(servlet): complete migration javax to jakarta
• 3cad1c4aa fix(UI): Add lang attribute to ReadmeOSS.html for generated license info.
• 77b801825 fix(keycloak-spi): Added the README.md
• e43c3422a fix(nouveau): fix nouveau query result
• 442ac94c7 fix(test): fix test cases with cloudant SDK
• 41e3d4605 fix(nouveau): extend nouveau connector as cloudant
• cbcffd979 fix(cloudant): fix query builders
• ced70a0e4 fix(cloudant): fix views
• 57f5b6908 fix(REST): Patch Release is causing the clearing state to be updated to NEW even if a Clearing is existing
• 5c4810a56 fix(backend): fix dependency for backend core
• f0719b97a fix(rest): Resolved null value returning for svm tracking status.
• fe05d9f29 fix(rest): Update search API to return 200 status with empty results array when no match found
• b0c11a1fb fix(GenerateLicenseInfo): Generate License Info failing for releases having the same CLX
• d6f630021 fix(rest): Ensure visibility field is case-insensitive
• 6a1408f50 fix(doc): fix OpenAPI doc for Search endpoint
• 83796a935 fix(rest): add requestClosedOn field in get clearingRequest_by_id endpoint
• 45a8137f3 fix: Update docker documentation to reflect current status
• 9dc2d6835 fix(rest): Enable back authorization and resource server with up to dat springboot
• c493d83bf fix(couchdb): Move setup data for single file and update compose to use as read only
• c15e36cd8 fix(docker): Use Tomcat with Ubuntu 24.04 (Noble)
• d655adc64 fix(rest): Add null check for linkedProject field if it is empty
• 77bdbf7f6 fix(rest): Add null check for linkedProject field to prevent Internal Server Error on GET request to fetch the linked projects of a project
• 5943127c6 fix(rest): Add code to update user details when creating a moderation request.
• 9777923f8 fix(docker): Reinstate docker builds
• 0265205b0 fix(docker): Update docker build to fit Ubuntu Noble and improved caching
• 293e025cf fix(rest): Added JWT token convert to fix the issue with authorities
• 540f9baf1 fix(rest): Added the Oidc user info customizer and token customizer
• 1fb7bcf97 fix(rest): Add null check for linkedProject field to prevent Internal Server Error on GET request to fetch the linked projects of a project
• 3f6ae983b fix(importCDX):Improve error message when PURL is invalid
• 3dfbb5538 fix(rest): Fix internal server error with 500 status code for link project to projects endpoint
• f0e149422 fix(rest): Fixing pagination for endpoint '/packages'.
• 0d88cacc7 fix(rest) : Non uniform link format in attachmentUsage end point
• fea2d4eda fix(rest): Fixed the swagger issue
• 01218278d fix(backend) : Product clearing report generated has strange numbering issue fix
• da95be6e7 fix(rest): Added modifiedBy field in get package_by_id endpoint.
• 82ad83e70 Revert "fix(rest): Fixed the swagger issue"
• cc38d07df fix(rest): Fixed the swagger issue
• 51fabdfc2 fix(rest):Added code to resolve the server error while fetching a summaryAdministraion endpoint.
• b262c4c82 fix(rest): Fixing the rest test cases
• 308ce540b fix(rest): Added a missed field in package endpoint for allDetails.
• 8f0560c04 fix: Only publish test report on failures
• f48e6d27b fix: Thrift cache location
• b69720c91 fix: Update thrift build to fix github caching
• 89f47fe05 fix(test): Proper build tests now without jump folders
• 4dd4f8aa7 fix: Remove wrong placed copyrights on commit template
• f8dcd79f2 fix(test): Disable rest test to avoid chicken and egg integration
• 7ce112133 fix(github): restore pull_request_template.md

Infrastructure

• 4e883a5a1 chore(deps): bump org.springframework:spring-context
• 7dd44a5fd chore: Add maven validation on build
• d086e9a71 chore(deps): bump org.keycloak:keycloak-core
• 2d90a9a00 chore(deps): bump org.keycloak:keycloak-core
• bfd296052 chore(maven): deploy keycloak listeners
• c71b0d5c4 chore(maven): segregate war and jar deploy dirs
• d9b3edf25 chore: Add Tomcat 11 default for Docker
• 872c74ef1 chore(nouveau): catch exception for nouveau query
• 824504564 chore(docker): update compose with dockerhub image
• 3fc2e0976 chore(couchdb-lucene): remove third-party/couchdb-lucene
• 111a0fe88 chore(refactor): Refactored the models by adding Lombok
• e3dccf3ee chore: Reduce couchdb log level on docker compose
• e3f3dab7e chore: Update the license header checkfor CODEOWNERS
• af056ef15 chore: Properly set components servlet as war file
• 27fddd182 refactor: Use the correct thrift image
• 56b63f065 refactor: Remove dead code comments
• 7b3fe9233 chore: CouchDB setup can't be read only
• 442970d4c chore: Add color coding for sw360 project
• 30b6114f8 refactor(backend): Adjust component test call
• 9a09353af refactor(backend): Disable ComponentImportTestUtils
• a0369e0a3 refactor(backend): Allow test properties be configurable
• b7d9941dd refactor(backend): Fix licenseinfo test
• 2f24d0b3e chore: Disable logging on disk for couchdb and configure authorization server
• bc759edb4 refactor(backend): Restore webapps install
• a9cff25ea chore: Fix version dependencies
• a81fe91dc refactor(backend): Remove invalid recursive add-build-configuration process
• a973a70f4 refactor(backend): Disable usage of Handlers by importer
• 2019328a3 refactor(backend): Adjust dependencies for...

sw360-18.1.0-M1

sw360-18.1.0-M1

This tag includes important corrections and fixes following the 18.0 pre-release. It is also the final tag with Liferay, as SW360 will use the SW360-frontend project (https://github.com/eclipse-sw360/sw360-frontend) starting from the next release.

Migrations

For existing installations, a data migration is required with PR 1963. Please go to the readme file in scripts/migrations to see more information:

https://github.com/eclipse/sw360/blob/master/scripts/migrations/README.md

Note: For running the migrations scripts, you will need python and the couchdb package. Please note that you will need to change manually in the python file: the DRYRUN variable and the couchdb URL (if that is not on localhost or requires password or both).

SW360 18.1 Native Install Deployment

https://eclipse.dev/sw360/docs/deployment/legacy/nativeinstall/native-install-sw360-version-18.1.0/

Credits

The following github users have contributed to the source code since the last release (in alphabetical order):

> Afsah Syeda <[email protected]>
> Aftab, Farooq Fateh (ext) <[email protected]>
> Anupam Ghosh <[email protected]>
> Akshit Joshi <[email protected]>
> Eldrin <[email protected]>
> Gaurav Mishra <[email protected]>
> Helio Chissini de Castro <[email protected]>
> Jens Viebig <[email protected]>
> hoangnt2 <[email protected]>
> Keerthi B L <[email protected]>
> Nikesh kumar <[email protected]>
> rudra-superrr <[email protected]>
> sameed.ahmad <[email protected]>
> tuannn2 <[email protected]>

Please note that also many other persons usually contribute to the project with reviews, testing, documentations, conversations or presentations.

Features

• 4bfabe486 feat(rest) : Remove mail-request parameter and read from config file
• 96863d14c feat(REST): Search package by purl and version
• 684d90117 feat(REST): Create clearing request for a project and move the preferred clearing date limit field out of Liferay"
• fe044d00 feat(project): Added release field for licenseObligation get endpoint
• 70837b27 feat(rest): filter attachment usages in project
• ea94202b feat(license): Update Whitelist
• af155858 feat(CR): Update clearing request state from AWAITING RESPONSE to PENDING INPUT
• 2bd2b2fd feat(vscode): Add workspace java settings
• 8ceba8fb feat(docker): Add test build using docker
• 944a7164 feat(rest): added pagination for vulnerability tracking status page.
• 70391d07 feat(rest): add license obligations to a project.
• 4f65386f feat(obligation): endpoint to list license obligation table data
• 5fcb3533 feat(rest) : endpoint to list license obligations from license database.
• 240c73f3 feat(CR): Create a new Clearing Request state Sanity Check to perform sanity check before accepting a project
• 4bc56326 Revert "feat(CR): Disable Clearing Request creation for the projects which have linked releases without SRC type attachment"
• 71d3a470 Feat(User): Create new endpoints to Create/Revoke/List rest api token
• d4820efc feat(Rest) : Download license clearing report end point.
• 14fda713 feat(api): new endpoint /mySubmissions
• cec7f4b7 feat(docker): Improve output of check_image script.
• d7699485 feat(docker): Revamp docker build setup
• 2ddf76f0 feat(user): Enable API user endpoint by default
• 36a41cef feat(Obligation): adding obligation type data in license obligation table.
• 44219a39 feat(rest) : Pagination for vulnerability tracking status
• b925c0ab Revert "feat(UI): enhanced date filter for open and closed clearing requests tab"
• a3038447 feat(UI): enhanced date filter for open and closed clearing requests tab
• 9f9a1ffa1 feat(UI): Add an info button in the create CR page
• b98d346a4 feat(UI): Add clearing type column in closed clearing request tab
• b6aa50650 feat(Project): - Extract license from all releases in dependency network when download license information of a project - Generate source code bundle from all releases in dependency network when download Generate source code bundle for a project
• 49f5486fa feat(rest): endpoint to link sourceProject to list of projects.
• 1ab14350b feat(CR): Disable Clearing Request creation for the projects which have linked releases without SRC type attachment
• bcd600c26 feat(User): Add new endpoints to get/update requesting user profile
• 3cb73c19f feat(rest): Create new endpoint to unschedule all services.
• 83a2b3a28 feat(license): Listing obligations by license
• 8a9c407e8 feat(license): Fix Update License isChecked
• 89a75f815 feat(project): Update ghactions workflows deps
• 849e10a0c feat(obligation): Add api listing obligations by ObligationLevel
• 3ec2cb129 feat(rest) : Rest end point for releases by lucene search
• 7ccba71d5 feat(project): Setup Sonatype publishing
• c0fb731c4 feat(license): Create API Export License
• 141e24bab feat(Release):Upload Source Code Attachment to Releases through a Scheduled Service
• c7c33c78f feat(rest): adding pagination for listing vendors endpoint.
• c805ff90f feat(rest) : Adding or Modifying fields to project summaryadminastration page
• 6a89beabc feat(Script): Delete MR's for a specific user
• adc862038 feat(license): Create new api update license

Corrections

• dfabecd2c fix(importCDX) : Fix package's linked release updation when an SBOM is imported
• 3de514387 fix(project): adding project owner field in project get endpoint.
• c31464972 fix(api): throw 409 if last moderator
• 219792b1 fix(importCDX): Resolve incorrect package/release count in import summary
• 6d9f3620 fix(rest): Create a new endpoint for dataBaseSanitation.
• ae997be2 fix(project): Update outdated Github actions
• cb02b200 fix(sw360): changing mkdocs version
• 0c9523fb fix(REST): Improve error message handling for CycloneDX sbom import using REST API
• df735e9b fix(Release): Updating the license overview in the summary page
• e5ac9278 fix(SRCUploadService): Source upload should work for release versions having alphanumeric characters
• fa42d204 fix(api): provide typeMasks name as Optional type
• 6e36abbb fix(api): check project modifier before embedding
• 3beff049 fix(Project): Fix bug Expand Next Level and Collapse All button are hidden when click on sort icon
• 5112980f fix(urlEncoding): url encoding.
• fe0a4408 fix(Release): Add embedded other licenses in release response
• d4a8be84 fix(importCDX): Packages without VCS in SBOM having VCS in SW360 are not getting linked to project
• 8af9bd5e fix(importCDX): Add check for existing comps and package using case-insensitive comparison of vcs and purl
• ee3ed068 fix(Liferay): Fix bug cannot access oauth client page when import lar file
• edc9320c fix(rest) : attachment usage type fix in response
• 49be7428 fix(importSBOM): Remove the invalid characters appearing in import summary message for invalid packages list
• 5a726764 fix(rest): create endpoint for search by userName using lucene search.
• ff068133 fix(rest): Added releaseId in recentRelease and release mySubscription.
• 87a14f7a fix(Rest): Added status for mysubsciption in component.
• d28843c2 fix(docker): Fix broken binaries context inclusion
• 16475d70 fix(rest) : create new endpoint for cleanup attachment.
• 0950a2ca fix(script): update modifiedBy/modifiedOn project fields.
• 67696a9f fix(department): Division by zero caused by bad default value for interval
• 9703661d fix(rest): Added primaryRole and secondaryDepartmentRoles fields for user endpoint.
• fba0d8e5 fix(rest): Added modifiedBy field in project search by id.
• 178813e5f fix(docker): Adjust local naming for docker images
• b55372562 fix(thrift): Add proper version to build
• 34765dd80 fix(thrift): Follow link download step
• ef5cc0142 fix(database): Restore reading environment database vars
• 8aaf95734 fix(UI) : Issue fix for vulnerability not displaying for project
• c63023c4d fix(release): modify the externalId query parsing
• 6a6cb33b5 fix(docker): We have been using wrong Java version
• 625ffcfa1 fix(release): revert external id query parsing
• 222879a9e fix(rest): error handling when user dont have sufficient import permission
• d619c5121 fix(Table): Fix error of hiding attachment table content when clicking sort
• ef83441df fix(moderator): show message when only moderator choose remove me option.
• 590a2b3ad fix(docker): Remove deletion that invalidate image
• 2fe147f09 fix(rest): create new enpoint to check server connection.
• 47d14b158 fix(script): Fix migration script not working with python3
• 0d535c386 fix(config): Correct file number
• 0f9d9b85a fix(rest): create a new endpoint for fossology in admin tab.
• 5b9f10921 fix(script): Fix incorrect numbering for migration scripts
• 0f9d31974 fix(couchdb): Add config entry to disable couchdb cache
• 451948a79 fix(javadoc): Remove invalid link reference
• 05c2445fa fix(lib): Add meta information to enable publish
• b5f6cb469 fix(importCDX): Update failed component creation error message
• 6e1964a40 fix(rest-fossology): applied changes for upload endpoint
• 5a83fe2c9 fix(RequestsPortlet): Unable to reopen CR, Open Components to display open releases, clearing progress to show percentage
• 2fdd5f4c5 fix(Rest): Allowing search for releases using externalIds
• d9fce216f Fix(package): Fix issues api for package - Cannot unlink orphan packages from the project - Cannot link a package to a release without any package - Handle message when package with same purl already exists
• 02d84be81 fix (rest) : rest api created for component search by lucene search

Infrastructure

• e71c5e53f Revert "build(deps): bu...

sw360-18.0.0-M1

sw360-18.0.0-M1

This tag covers many corrections/bug after the 17.0 release and multiple new endpoints to support sw360 UI project.

Migrations

For existing installations, a data migration is required with PR 1963. Please go to the readme file in scripts/migrations to see more information:

https://github.com/eclipse/sw360/blob/master/scripts/migrations/README.md

For running the migrations scripts, you will need python and the couchdb package. Please note that you will need to change manually in the python file: the DRYRUN variable and the couchdb URL (if that is not on localhost or requires password or both).

Credits

The following github users have contributed to the source code since the last release (in alphabetical order):

> Abdul Kapti <[email protected]>
> afsahsyeda <[email protected]>
> Anupam Ghosh <[email protected]>
> Dinesh Ravi <[email protected]>
> Eldrin Sanctis <[email protected]>
> Gaurav Mishra <[email protected]>
> Helio Chissini de Castro <[email protected]>
> hoangnt2 <[email protected]>
> Keerthi B L <[email protected]>
> Kouki Hama <[email protected]>
> Le Tien <[email protected]>
> Muhammad Ali <[email protected]>
> Nguyen Nhu Tuan <[email protected]>
> Nikesh kumar <[email protected]>
> rudra-superrr <[email protected]>
> Shi Qiu <[email protected]>
> Smruti Prakash Sahoo <[email protected]>
> Tien Le <[email protected]>
> tuannn2 <[email protected]>

Please note that also many other persons usually contribute to the project with reviews, testing, documentations, conversations or presentations.

Features

• e9a9f308b feat(rest): Adding pagination for ecc info of releases for a project.
• c0db06a68 feat(rest) : Adding pagination for listing users endpoint.
• acc553b14 feat(rest): endpoint to get attachmentUsages for a project.
• bb0d01fd5 feat(rest): endpoint to get license clearing count for a project.
• bc5ae7d1b feat(rest) : Add enableSvm field in response to projects api
• 130ed2585 feat(importCDX): enhanced sw360 CDX importer
• 754ba96a7 feat(CreateCRandRequestsPortlet):Added new field Clearing Type for CR and Additional columns in Open CR table
• b89bde7b9 feat(Rest): Modifying the document for search endpoint
• ec750b824 feat(bug) : Download release attachment fail issue fix
• f629a0d3f feat(rest) : End point for export vendor spreadsheet
• 930ef1d13 feat(docker): Add option to specify cvesearch.host at build time
• f4febd954 feat(release): Fix response api get single release with costDetails
• 70141590c feat(rest): API to get vulnerability tracking status
• 03aaa6985 feat(Rest): New endpoint allow load assessment summary information of release
• 8c2e71b85 feat(ui):enable to bulk delete component/releases for admin SW360
• 266aeac3d feat(REST): Add restricted project counter for component and release usedBy API
• ca0ef31f2 feat(rest):Update API Create Release with Cost Detail
• 1974005e2 feat(ui): Added collapse and expand icon for all the tabs
• 16dae1a4a feat(rest): API to get vulnerability tracking status
• afe118d96 feat(Rest): New endpoint allow load SPDX license info from attachment of release (ISR, CLX, CLI)
• a330fde1e feat(rest): Update release with attachment info
• ba6c743f5 feat(ui) : Add changelogs for license pages
• d369c73e3 feat(rest): Update API create Release with Moderator, Contributor, CpeId
• c9c37b94d feat(rest): Update API create Release with LinkedRelease
• d7b52f53e feat(rest): Add Information Vendor to response Get release detail
• 4449e6017 feat(liferay): Export private pages include package portlet
• 7c57b8081 feat(rest): Add information user change status attachment when edit component by API
• d25d35ce3 feat(Project): New configuration make project and releases relationship more flexible
• de4125bb4 feat(debug): Add Tomcat manager to docker
• fd13d1943 feat(rest): listing license clearing info of a project.
• cc9291d68 feat(CycloneDX): support CPE in import and export
• 42f44107f feat(rest): Update Component with attachment
• d8c594628 feat(REST): New endpoint to write SPDX license info into release
• d356bc022 feat(UI): Package Portlet Signed-off-by: akapti [email protected]
• 6aa0b8d7e feat(rest) : asynchronous end point for report download
• 4d4c863ad feat(RequestsPortlet): Added On Hold value for request status and Next/Last 15 days filter
• fd159f302 feat(Components): Add a new field VCS/Repository URL for components
• be9e5f5bb feat(rest): New Endpoint create attachment
• 34e2d9e77 feat(Rest): Rest API allow to re-generate fossology report
• f4432c98b feat(rest):Adding new fields to get list of project vulnerability
• efbe761f5 feat(ExportSpreadsheet): Add project and release ID to the exported excel
• b7740902b feat(ProjectObligationsEdit): Save comment and status fields on edit
• a7bc2969c feat(rest):New end point for my components
• a4e7f6808 feat(REST): New endpoint split components
• 447143b8e feat(rest): To list linked projects of sub-projects.
• ed7f4e237 feat(Department): New function for Department Management
• 662a05977 feat(rest): new endpoint merge component
• 1bf157600 feat(UI/REST): CycloneDX SBOM Importer & Exporter
• e8f6e6b26 feat(rest): update response API Get a single release
• 57b02aa29 feat(REST): Update response endpoint get attachments by release
• 410184928 feat(ECC):Added pagination to ECC release list
• b6d58b979 feat(ui): add note filed in license page
• f14f9b0e4 feat(rest): update response API Listing users
• c27a2fe35 feat(rest): update response API Listing vendors
• 9bd7869f4 feat(update): update response api get single component
• 90c59acb4 feat(rest): modify moderation requests
• 8e71c959c feat(ci): Use actions java setup instead of standard packages
• 037acd41b feat(ci): Use actions java setup instead of standard packages
• a7af308fa feat(ci): Update build and test to accept dispatch
• 669d6f98b feat(rest) : api to get count of projects
• 1c4b223f8 feat(update):update response api get attachment by component
• e6374e820 feat(api): create new endpoint import bom for component
• 462675325 feat(api): create new endpoint update vulnerabilities of a release
• 4dbc8705a feat(api): create new endpoint update vulnerabilities of a component
• bc368f203 feat(REST): Endpoint for Download Attachment Bundle of Release
• 764a24c6c feat(api): Endpoint get release overview by component
• 391c006e6 feat(REST): Endpoint for Download Attachment Bundle of Component
• 96a032814 feat(api): endpoint get vulnerabilities of a component
• d10048956 feat(rest): new endpoint /moderationrequest
• e682a50fa feat(spdx): Added support for pasring of SPDX-2.3 (ISR) generated via fossology
• b7710e630 feat(lucene): Modify pom to generate proper war from couchdb lucene
• 53236b590 feat(libs): Add couchdb-lucene as third party
• 84e098774 feat(project): Prepare to introduce thirdparty libraries
• c80f75908 feat(rest):Components with all details Rest Api doc updated
• b32e90154 feat(REST):Endpoint for sbom import
• 249f48f49 feat(SPDX): Making new tab in component release pages for showing SPDX/SPDX Lite data #1240
• 9d566af03 feat(rest):New end point for my components
• 53c8d85da feat(clearing): Improved cloud backend clearing
• 2e0732a2b feat(rest): Added basic username and password based authentication
• 4f171a659 feat(rest): optimize fetch project
• 729207997 feat(EditCR): Admin will be able to reassign/edit the Requesting User of CR
• 56096f24a feat(ProjectUI):ExternalIds and Additional Data fields in Export Excel
• 7b84b0e4f feat(api): get vulnerabilities from relase by api
• aafc95808 feat(rest) : Update data without moderation request And This features' a configurable setting
• 73ba7012d feat(docker): Use main Maven docker image
• d6555a370 feat(rest): endpoint for linked projects.
• e20d7bf06 feat(rest): new endpoint /releases/recentReleases
• c5aea6f4e feat(rest): newendpoint /components/recentComponents.
• d707d7b53 feat(rest): new endpoint /projects/myprojects
• 0f95fd368 feat(project): Added Email functionality for individual project spreadsheet export
• ff92cd956 feat(ProjectUi): Enable Release with only one non-approved CLI for 'Adding License Infor To Release' and 'Displaying Obligations' (#1764)
• f5daadb6e feat(Search): Added restricted search (#1797)
• df0a6a123 feat(ui): Add banner to broadcast messages (#1830)
• d4cd90f67 feat(Project): Added Vulnerability Summary Tab in Projects.
• ca1da16fe feat(ProjectsUI):Changed Expand All To Expand Next Level and added alert message
• b682060ae feat(Advance Search): Provided an 'Exact Match' checkbox in Advance Search that inserts (") around search keyword
• b0ccdc480 feat(ci): Add thrift binary to cache
• 95009d35f feat(project): Add pre-commit and spotless
• eabbb0053 feat(svm): Publish SVM codes to Community

Corrections

• 5e48f83b2 fix(importCDX): Remove view BY_VCS_LOWERCASE and BY_PURL_LOWERCASE
• e94d9c729 fix(Moderation): Fix bug could not open Release and Component moderation request
• 45b317d86 fix(rest): adding additional fields to rest response for linked projects.
• 4e329b464 fix(license): Update Response api for single license and Add rest-docs api create license
• d261f70e5 fix(rest): Added new endpoint for LicenseType in admin tab
• 41d735f9a fix(package): Can't link project to package
• 1debd1e2c fix(REST):Get Component failing for names with space
• 521835e38 fix(UI) : Added code to import the upload license in admin tab
• f748c7cba fix(package): Create package by API can't link release
• eb7efb3f9 f...

sw360-17.0.0-M1

sw360-17.0.0-M1

This tag covers many corrections/bug fixes after the 16.0 release.

This release provides features, multiple bug fixes for release 16.0, for example, new REST endpoints, improved docker script and fixes related to liferay-7.4.3.18-ga18

Migrations

For existing installations, a data migration is required. Please go to the readme file in scripts/migrations to see more information:

https://github.com/eclipse/sw360/blob/master/scripts/migrations/README.md

For running the migrations scripts, you will need python and the couchdb package. Please note that you will need to change manually in the python file: the DRYRUN variable and the couchdb URL (if that is not on localhost or requires password or both).

Credits

The following github users have contributed to the source code since the last release (in alphabetical order):

Abdul Kapti <[email protected]>
afsahsyeda <[email protected]>
Anupam Ghosh <[email protected]>
dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Eldrin <[email protected]>
Gaurav Mishra <[email protected]>
Helio Chissini de Castro <[email protected]>
Jaideep Palit <[email protected]>
Kouki Hama <[email protected]>
Muhammad Ali <[email protected]>
Nikesh kumar <[email protected]>
rudra-superrr <[email protected]>
Smruti Prakash Sahoo <[email protected]>
tuannn2 <[email protected]>

Please note that also many other persons usually contribute to the project with reviews, testing, documentations, conversations or presentations.

Features

• a20704c7 update(lang): add chinese lang property file
• f9d23047 feat(MailApi): enable control over trusting the email host
• 3707569d feat(rest): new param (allDetails) added in component call to get more details of component
• 65011f18 feat(UI): Applying sorting on release versions in drop down when inspecting a component.
• c8597b45 feat(SPDX): Upgrade tools-java library to support SPDX 2.3 format
• 684d3c6a feat(ProjectUI):License Info In the Spreadsheet Exported from Project License Clearing
• 111d5876 feat(RESTapi): created new endpoint for clearingrequest and modified existing endpoint payload
• 8cb48cd8 feat(AdminUI):Changed the title of the button in Edit Client modal to 'Update' from 'Edit' and set the validity to 'Days' by default in OauthClient
• e6a81fe0 Feat (Vulnerability): Improve add/update/delete vulnerability APIs implement add/update/delete vulnerability by GUI
• e9b035f2 feat(buildsystem): Rearrange dependencies and deployments
• b4c14975 feat(CRUI):Change CR state 'On Hold' to 'Awaiting Response' & edit PreferredClearingDate
• 35d9e021 feat(docker): Move deps script outside docker build
• db5176ab feat(deps): Update shared slim script to have a txt file with libraries
• 4596f06d feat(SPDX): Use new SPDX library (#1496)
• d6ba4c07 feat(docker): Improve docker size and build time
• 467edfba feat(UI):Made the table header collapsable in wherever possible
• 1550e909 feature(ui) : select your group in Project page by grid
• 3b4e36c7 feat(search): allow searching for external ids
• 27869c8a feat(ProjectUI): Load License info header text based on project group

Corrections

• 93363bd7 fix(dependencies): Update okhttp and httpclient versions
• 35ea249b Fix(Vulnerability GUI): Fix bug cannot load vulnerability view page
• b131a5bc fix(ProjectUI):Stale data displayed after using the Group filter in Project Advance Search
• 2cd58b9f Modified the check so that searchQuery is considered when submitSearch is empty
• 01eecf3a fix(ProjectUI): Changing Project group should update CR
• 4ca47851 fix(REST): Save otherLicenseIds while patching Release - 1735
• e97c8188 fix(UI): Added new column in exprot spreadsheet in project tab
• ae77534c Fix(Obligation): Fix bug can not add/update Admin Obligation and import OSADL
• 06b741b0 fix(SPDX): import SPDX licenses with new SPDX library (tools-java 1.0.4)
• 5d86c067 fix(moderation_request): Added a check that if documentId is null then ignore
• ac308a5d upd(CI/CD): Build and test only during the PR.
• 7da2858a upd(docker): Fix wrong branch
• 42cce1a6 upd(docker): Publish push to main commits
• d0432233 fix(script): Script to remove trailing and leading whitespaces from component names
• 4f7fd085 fix(ProjectUI): Multiple alerts when there are same linked projects
• f6c22e52 fix(PreferencesUI):Read Access has to be checked before Generating token
• 920d1281 fix(docker): Deploy libraries in correct place
• 1564ab79 upd(doc): Update docker documentation related to redirects
• 5c9e7845 upd(docker): Improve docker build and github actions
• 7bcb75db upd(docker): Improve github actions pipeline
• 03e665ec fix(docker): add missing dependencies
• b679b883 fix(UI): Unresponsive UI & top align session message
• 68f171f5 fix(UI): Added code to show the project list in component tab
• 8312a8e6 fix(UI): Text field is blank while ExportSpread in licenses
• 05b9c5f0 fix(User): CountryId does not exists while creating user with new Organization
• e0059eec upd(docker): Push sw360 docker image to registry
• 429b6b73 fix(UI): Default behaviour of write access checkbox restore
• 5ffcda69 fix(Project and Component UI): Formatting issues and the type of files that can be uploaded in Import SBOM MOdal are limited to rdf now-783
• 32ea05fe upd(buildsystem): Move away build-configuration
• 8c09cfa1 upd(deps): Update jackson versions
• b7757326 Fix(ProjectUI): Fix bug when editing obligations in a project.
• 46e2b73d fix(CouchDbView): Improve couchdb view performance
• 282298e0 fix(Docs): Fixed REST and MkDocs generated issue
• 9a1dcb48 fix(ecc): Reset Ecc Fields when Component type is changed.
• a5ece957 upd(sanitize): Remove lib prefix from datahandler
• ca8b2efc "fix(rest): Added code for to Update the REST-API documentation for Definition of Manufacturer on project level
• 14103917 fix(ComponentUI):HTML encoded character in Vendor field
• 01448d74 fix(scripts): Sanitize scripts
• 13753dbf upd(ghactions): Fail fast with the license checker without setting a full blown system
• b365744e fix(bnd): Restore original bundle
• 8682aa42 fix(docker): Dependencies need to be deployed
• aa4b625e upd(docker): Move versions to separate file and update dep script
• 9d3e9b3f fix(versions): Update commons lang to correct last version
• 7ee69887 fix(SBOM): Fixed Component type is not being set when components are created by importing SBOM
• db359094 fix(ecc): Script to change ECC status in Release
• daa15a90 upd(thrift): Use only provided tarball to generate resources
• 932987bc fix(maven): Update commons-logging to equal versions
• d9f594ec fix(maven): Update commons-codec to equal versions
• 41450708 fix(liferay): Use unique versions for same dependencies
• 5acd4ecb fix(maven): Use unique versions for same dependencies
• de429b3f bug(docker): Fix share location of jar files
• 5e0a30cd fix(ui): Fixed lar file to add missing widgets(Oauth Client & License Types)
• adb4f930 fix(ecc): Script to cleanup ECC information in release
• d0ead7d1 fix(rest): Added component type tag in release api
• f0f308e4 upd(maven): Update maven build infra
• 2db4244f fix(UI): Do not copy specific external id while cloning release
• b8190e25 fix(UI): Disable write access from UI
• 9f5e1ddd fix(CrUi): fix the critical CR creation issue
• a6f8fa65 fix(ProjectUI): fixed Release filter bug in AttachmentUsage tab
• 77e0ec1d fix(ui): Generate portlet X url inside portlet Y
• 33908857 fix(report): Nullpointer downloading report
• e1dd21fc fix(jenkins): Update old eclipse jarsigner
• f35c6244 fix(deps): Fixed wrong dependency download
• 7ba948c4 fix(docker): Fix double called shutdown script
• d2d8011f bug(docker): Fix invalid commited docker props
• 9cddc708 upd(Docker): Upgrade docker and versions for new Liferay
• 3a0d8c38 fix(AdminUI): Prevent license type duplication with case insensitive check
• 17a82169 fix(ui): cannot link Component with closed project
• 6d0a20ef fix(REST): fixed release update issue for releases with invalid licenses

Infrastructure

• a2b75597 fix(doc) : update migration Readme
• b7048928 upd(README): Update with new information
• e130c068 chore(deps): bump spring-security-core in /frontend/sw360-portlet
• 6b8c6e7d Update githubactions.yml
• 8602a169 WIP
• e7e9858f chores(liferay): updated liferay kernel and theme
• 9e64374c chores(upgrade): Updated default country Id of liferay
• f19f0203 chores(upgrade): Fixed the ui issues
• 71145b2a chores(upgrade): Updated default country Id of liferay
• a7fd29d7 chores(upgrade): Fixed the ui issues
• 822597c2 Updated versions in bnd file according to Liferay 7.4.3.18 GA18
• 9efff9ff chores(upgrade): Upgrade Liferay to 7.4.3.18 GA18
• 32bc4839 chore(rel): Changing back to 16.1.0-SNAPSHOT

sw360-16.0.0-M1

sw360-16.0.0-M1

This tag covers many corrections/bug fixes after the 15.0 release.

This release provides features, muliple bug fixes for release 15.0, for example, new REST endpoints, new integration test suite.

Migrations

For existing installations, a data migration is required. Please go to the readme file in scripts/migrations to see more information:

https://github.com/eclipse/sw360/blob/master/scripts/migrations/README.md

For running the migrations scripts, you will need python and the couchdb package. Please note that you will need to change manually in the python file: the DRYRUN variable and the couchdb URL (if that is not on localhost or requires password or both).

Credits

The following github users have contributed to the source code since the last release (in alphabetical order):

Abdul Kapti <[email protected]>
Alberto Pianon <[email protected]>
Anupam Ghosh <[email protected]>
dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Helio Chissini de Castro <[email protected]>
hoangnt2 <[email protected]>
Jaideep Palit <[email protected]>
Kouki Hama <[email protected]>
Pham Van Hieu <[email protected]>
Smruti Prakash Sahoo <[email protected]>
Tran Vu Quan <[email protected]>
tuan99123 <[email protected]>

Please note that also many other persons usually contribute to the project with reviews, testing, documentations, conversations or presentations.

Features

• 1f6db6db upd(mockito): Update the deprecated old mockito-all to mockito-core
• 29d019b6 feat(ui): Ability to filter for active users
• 0d0de03c feat(ReleaseUi):Display AssessmentSummary info from CLi in Release details page
• 709a5ec9 feat(UI): ModifiedOn & MOdifiedBy fields for Project/COmponent/Release
• 73fe7e68 feat(export): Enable mailing for exported spreadsheet for components
• bbc37a93 feat(ProjectUI): added filter for linked release/projects table
• a9053df2 feat(ProjectUI): AttachmentUsages - Added option to filter for releases without source attachments
• f7aebb1e feat(rest): Add upload description to trigger fossology process
• 26226fbb feat(exportExcel): Send an email to user with download link once export completed
• 860e420d feat(exportExcel): Generate and save excel to file system, Download generated file with token
• 07b54e93 feat(UI): Display Licenses from Scanner findings in ISR attachments
• 9511adb7 feat(obligation): add function Edit/Duplicate/Changelog for Obligation
• 830f463a feat(ui) : Strengthen sw360 admin privileges about Read and Write
• 7dd31343 feat(compose): Common network adn Fossology decoupling
• 5974152f feat(ProjectUI): Disabled CR based on project Group
• 0f2e4c14 feat(rest): Get Project Vulnerability by external id and release id
• 3dfe2bbc feat(projectUi): Update some fields in a Project in closed state
• 440a6fda feat(docker): Overhaul SW360 docker
• 0dc962d0 feat(script): Addition to update project field starting with some value
• e5516c21 feature(docker): Run sw360 as non-priv user
• cec73056 feature(docker): Use volumes with tomcat
• 33481c32 feature(docker): Add fossology on the mix
• 4036a822 feat(project): Added vendor for project

Corrections

• 00271e79 Fix (Component): Fix bug component list sorting
• 3eb27362 fix(closedproject): Fixed issue w.r.t. editing close project
• 8911a4c4 fix(project): Added write permissions for closed project
• 1bef35d3 update(ghactions): Improve gh actions process
• bcdfad6b update(docker): Docker to use latest Ubuntu LTS
• 728acb20 fix(export): Added missing ECC AL column and release vendor in project export
• 8efc4871 fix(rest): Added release main licenses in the response
• 5f5bca8a fix(ISR):Fixed source file not found in ISR & Total files count mismatch
• b4f0b870 Fix (Release): Fixed vulnerability can't be deleted when it is linked with a deleted release
• f8052466 fix(UI): fix Some long sentence can't show property in License Obligation
• 8ead75c3 fix(ui): Display url, email, text of Additional Data for Component and Release
• bafd477f fix(CR-UI): fixed the count mismatch in Open Components column of CR table
• e776a969 fix(excel-export): fixed project filter issue while exporting excel
• bcc2d89c fix(Obligation): Save Admin Level Obligation based on Obligation topic
• 1bec6af2 fix bug Invalid GitHub action #1519
• 9bc9b9bb Fix(License): Fix bug one license cound add only 10 obligations
• 4b7197b4 Fix(REST): fix visibility of Project Rest API
• aef08989 fix(docker): Add better proxy documentation to docker-compose
• 534ee6f7 fix(ui): Fixed Obligation count in project view
• cac1b13e fix(thrift): Updated thrift configuration to adopt configurable max message size and max framesize
• 2fab647b typo in the docker run command
• 8d1ddfc3 fix(compoent-visibility): Moderation request for clearing admin
• d92ecace fix(ui) : modify translation for search function
• 3792db20 fix(ModerationRequestUI): Fixed project Moderation Request UI is not loading
• 1c0dd050 fix(Dockerfile): Make Dockerfile more consistent
• a8c2334e fix(merge): Optimized code to check for write permission of release and components before starting to merge
• 9bbb49ba fix(modReq): Fixed moderation request for release with version overwrite
• d1fd4307 fix(ReleaseClearingState): ClearingState not changing to New from Scan Available
• cbec94a4 fix(api): Correct the ECC status when release is created by API
• f0f9ff62 fix(docker): Added missing license
• 6fb1f415 fix(docker): Add Document Library as volume to enable keep custom settings
• fde1f460 fix(docker): Add proper missing clucene config
• b719f989 fix(docker): Add better proxy handling
• 11e24172 fix(docker): Get liferay from github releases
• 6bddc2bf fix(docker): Reduce first bootstrapping
• 5df8eb4a fix(docker): Update README_DOCKER.md
• 0e917987 fix(docker): Update documentation with CSS issue
• e1a21e07 fix(docker): Update documentation with CSS issue
• cfe7e413 fix(docker): Improve documentation and persist porta-ext.properties
• e335c374 fix(docker): README update and cert ignore for curl
• ab23d0cc fix(docker): Thrift builds now under tmpfs
• ff9409fd fix(docker): Improve build speed and build layers size
• 5467abf9 Update docker base using Eclipse Temurin
• 681eb0c4 fix(ui): Restrict visibility of each component/release like Project
• 0b06f3ee fix(ui): Fixed pagination of component list with search params
• f14298a4 Fix search function with key is empty

Infrastructure

• 7332bec0 chore(dependencies): spring vulnerbility - cve-2022-22970,cve-2022-22971
• 3efa3a56 (chores): updated README.md and download_dependencies.sh files
• 7541ec8d chore(deps): bump spring-security-core in /frontend/sw360-portlet
• a17efda8 chore(deps): bump gson from 2.8.6 to 2.8.9
• 18763b51 chore(deps): bump jackson-databind from 2.11.3 to 2.12.6.1
• 2502b58d (chores): fix security vulnerabilities
• ce57d9b5 Update information about port redirection
• ea798093 Update README_DOCKER with typos fixing
• a7a75336 chore(rel): Changing back to 15.1.0-SNAPSHOT

sw360-15.0.0-M1

sw360-15.0.0-M1

This tag covers many corrections/bug fixes after the 14.0 release.

This release provides features, muliple bug fixes for release 14.0, for example, new REST endpoints, new integration test suite.

Credits

The following github users have contributed to the source code since the last release (in alphabetical order):

Anupam Ghosh <[email protected]>
dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Gaurav Mishra <[email protected]>
He, Albert <[email protected]>
Jaideep Palit <[email protected]>
ravi110336 <[email protected]>
Smruti Prakash Sahoo <[email protected]>

Please note that also many other persons usually contribute to the project with reviews, testing, documentations, conversations or presentations.

Features

• 9807d381 feat(ui): Added new Clearing State and Attachment Type
• 77f06a6e feat(ci): Remove dependency of commonsIO from client
• be212373 feat(ci): Fixed Attachment test cases
• bf43f889 feat(ci): Fixed Release test cases
• 790c935f feat(ci): Fixed component test cases
• 32ae085f feat(ci): Run Client Integration Test for rest api on DB
• 77f49ec2 feat(ui): Added new column for ECCN in ECC status tab of project details view
• 8ed3c68d feat(AttachmentTypeUI):Add a new attachment type Security Assessment.
• 2e593adf feat(client): Added Java Client Apis for vulnerability endpoints.

Corrections

• 2b562699 fix(ci): Fixed vulnerability IT testcases
• 854c6453 fix(release): Fixed mainline state is empty when creating a release by ui or rest
• be26f6ca fix(ci): Fixed Project Client Testcases
• e06eb192 fix(ci): Fixed License Testcases
• 2261b62f fix(script): Fixed deployment status check after spring boot updat
• 02ecfe6f Fix default config not working issue
• 30e404bd Fix component list sorting error
• f6337094 fix(rest): Optimize rest api for get project by tag, type, group

Infrastructure

• 376d5b94 chore(deps): bump log4j-core from 2.17.0 to 2.17.1
• 4fc46d41 chore(deps): bump log4j-core from 2.16.0 to 2.17.0
• c386b4c6 log4j version upgrade to 2.16.0(log4j-vulnerability)
• b8ebd682 chore(rel): Changing back to 14.1.0-SNAPSHOT
• 0368ae99 chore(readme): Update release badge to latest

sw360-14.0.0-M1

sw360-14.0.0-M1

This tag covers many corrections/bug fixes after the 13.4 release.

This release provides features, muliple bug fixes for release 13.4, for example, new REST endpoints, new functions in the UI and changelog enable/disable from sw360.properties.

Migrations

For existing installations, a data migration is required. Please go to the readme file in scripts/migrations to see more information:

https://github.com/eclipse/sw360/blob/master/scripts/migrations/README.md

For running the migrations scripts, you will need python and the couchdb package. Please note that you will need to change manually in the python file: the DRYRUN variable and the couchdb URL (if that is not on localhost or requires password or both).

Credits

The following github users have contributed to the source code since the last release (in alphabetical order):

Abdul Kapti <[email protected]>
Anupam Ghosh <[email protected]>
Jaideep Palit <[email protected]>
Kouki Hama <[email protected]>
Michael C. Jaeger <[email protected]>
ravi110336 <[email protected]>
Shi Qiu <[email protected]>
Smruti Prakash Sahoo <[email protected]>
Tran Vu Quan <[email protected]>

Please note that also many other persons usually contribute to the project with reviews, testing, documentations, conversations or presentations.

Features

• e1923ac3 feat(UI): import OSADL obligation information and update screen of Adding new obligation
• 2b6b9a9d feat(UI): CLI file clean up assistant
• 3702de56 feat(rest): Added rest api to create duplicate of project
• 8ff2748f feat(RestAPI):Update the attachment status with the approver/rejecter Name and Group.
• e3d8122a feat(ProjectUI): Add new values to Obligation status
• 3bab5e99 feat(ui): Display,update vulnerability for linked projects in project details view
• 8d1f96ff feat(log): Added output processing of the change log
• a873ad83 feat(ReleaseUI): License to SourceFile Mapping
• 533ace69 feat(rest): Add Rest API for linking release to release

Corrections

• ea72ce63 fix(ui): Fixed redirect page from Release Edit page to Release Details page
• ce9d9550 fix(changelog):Fixed the file permission issue for sw360 changelog.
• 9ef38314 fix(rest): Change base url of health api from /actuator to /
• 843f1f8d fix(rest): Get component by name case insensitive
• 96a59335 fix(rest): Create duplicate project clearing state should always be open and not copied
• fc1f1e39 fix(sw360ChangeLog):Configure the sw360ChangeLog path.
• d27527d3 fix(docker): Fixed cannot upload attachment more than 1 MB by Rest Api
• 46e6eb18 fix(views): Optimize views for components
• 2e8a9cc8 fix(views): Optimize views for releases
• 21682a3a fix(views): Optimize views to load large projects
• 65719867 fix(rest): Fixed hateoas link not showing correct protocol
• 0ed91d75 fix(ui): Links in ReadmeOss as HTMl are not rendered properly
• edeb13d2 fix(ui): fix the bug that attachments usages in project cannot show other line
• 5bff785f fix(rest): Update project vulnerabilities
• 0202f9df fix(rest): Fixed projects loading issue in REST
• 62d8887b fix(UI):Component details not shown for the Security Admin Role.
• 1db9afda fix(rest): Added new parameter luceneSearch to Get Project List Api, to get project list based on lucene search
• 3305fc6b fix(Japanese) : Update and modify Japanese translations
• 2f85cf70 fix(projects): Fixed thrift timeout by optimizing projects loading
• aa8574eb fix(upgradeVersion): Updated resource server properties for Spring 2.X
• a0f1861b fix(upgrade version): fixed the test cases failure issue when generating the rest docs.
• 033d912a fix(upgradeVersion): Fixed Test case for authorization server with spring boot version upgrade * Refactored code and removed commented lines
• 71bf74bc fix(upgradeVersion):Upgrade version.
• 2e98d07d fix(RestAPI):500 Internal server error from releases API.
• eb6192bc fix(ui): Cleanup moderation request on deleting project/release/component
• 57e08173 fix(ui): Changes in External urls in Project are not registered in Moderation Request. Closed Moderation Request doesnot show Proposed changes
• 8b5ffecc fix(Rest):make SW360 REST API Get Releases by Name Case-Insensitive.
• 97a72951 fix(DBTestsFail): Migrating databasetest.properties to couchdb-test.properties.
• 6c3c51ec fix(log): Fix indentation issue in source code.
• 4ab50904 fix(MyProjectErrorMessage):update the error message in UI for the project which is not accessible.
• d2f22b80 fix(ui): Fixed js error while merge component/release with null additional data
• 9c4d2f0d fix(rest): Added exception processing for authorization
• af443442 fix(script): add password and user in couchdb-lucene.ini
• 318d0923 fix(docker):Update couchdb3.1 ubuntu20.04 liferay7.3.4 postgresql12
• 5ec1df6a fix(ci) added new files to license check script
• 26dc7333 fix(ui): Fixed create/update users with uppercase email or externalid
• db1c1a97 fix(ui): User should be able to edit group of project